CISA Exam Questions

Which of the following is MOST important for an IS auditor to confirm when evaluating security controls in a virtualized environment?

An IS auditor is examining cryptographic key management with a focus on ensuring the protection of cryptographic keys against modification and unauthorized disclosure. Which of the...

Which of the following is the BEST way to ensure Internet of Things (IoT) devices do not retain default admin passwords?

Which of the following responses to risk associated with separation of duties would incur the LOWEST initial cost?

Which of the following would provide the MOST useful information for evaluating whether network availability is meeting the performance objectives set by management?

Which of the following is the MOST important benefit of using control self-assessments (CSAs)?

Which of the following is the PRIMARY concern related to unapproved software usage within an organization?

Nonrepudiation services for e-commerce transactions is BEST achieved through which of the following?

Which of the following is the MOST important consideration when implementing a Zero Trust strategy for mobile, wireless, and Internet of Things (IoT) devices?

Which of the following is an IS auditor's BEST recommendation after identifying that HR staff create new employees in the payroll system as well as process payroll due to limited s...

Which of the following should be an IS auditor's PRIMARY area of focus when auditing an organization's deployment of Internet of Things (IoT) devices?

An organization uses AI models to analyze customer complaints and generate responses. Which type of audit should be performed to determine whether AI-generated text in responses to...

An organization's management has asked the internal IS auditor for input in developing a control to prevent the recurrence of a deficiency. Which of the following is the auditor's...

Which of the following controls BEST provides confidentiality and nonrepudiation for an online business looking for digital payment data security?

Based on best practice, which types of accounts should be disabled for interactive login?

Which of the following would be of GREATEST concern to an IS auditor reviewing an IT strategy document?

An organization has recently implemented additional application programming interfaces (APIs) to enhance data exchange with vendors. Which of the following is MOST important to ens...

Which of the following would present the GREATEST risk within a release management process for a new application?

Which of the following is the main objective of enterprise architecture (EA) governance?

Which of the following is MOST important for an IS auditor to review when the organization's primary objective is to improve system performance for customer-facing services?

An IS auditor observes that an organization uses generic user IDs for access to licensed enterprise resource planning (ERP) software. Which of the following should be the auditor's...

An organization has outsourced its internal audit activity to a third-party service provider due to financial constraints and the lack of appropriate skill sets. Which of the follo...

Which of the following should be the GREATEST concern to an IS auditor evaluating an organization's policies?

When processing speed is the highest priority, which cryptographic algorithm should be used to verify the integrity of a bit-for-bit copy from digital evidence?

Following a discussion on the results of a recent audit engagement, the process owner of the audited area has provided an action plan addressing the gaps and recommendations. The a...

Which of the following is a PRIMARY objective of incident management?

Which of the following is the BEST method to safeguard data on an organization's laptop computers?

Which of the following provides the GREATEST assurance that an organization has effective controls preventing connection of unauthorized Internet of Things (IoT) devices to the cor...

Which of the following is the MOST cost-effective way to determine the effectiveness of a business continuity plan (BCP)?

Which of the following public key infrastructure (PKI) elements provides detailed descriptions for dealing with a compromised private key?

A staff accountant regularly uploads spreadsheets with inventory levels to the organization's financial reporting system. The transfers are executed through a customized interface...

Which of the following IT service monitoring tools is MOST effective in identifying abnormal system events?

An IS auditor is reviewing the disaster recovery plan (DRP) of an organization with offices across multiple regions. Which of the following should be the auditor's PRIMARY focus?

Which of the following is the PRIMARY benefit of implementing an IT capacity management process?

Which of the following is an IS auditor's MOST important step in a privacy audit?

How does public key infrastructure (PKI) help to verify that a digitally signed document is not a forgery?

The PRIMARY purpose of a vulnerability assessment in a cybersecurity program is to:

Which of the following is a PRIMARY benefit of an integrated audit?

Which of the following BEST describes the concept of fault tolerance in system resiliency?

A KEY benefit of integrated auditing is that it:

Which of the following performance management tools BEST helps an IS auditor evaluate the success of an organization's IT strategy implementation and execution?

An IS auditor is asked to provide feedback on the systems options analysis for a new project. The BEST course of action for the IS auditor would be to:

The management of a small e-commerce firm is concerned about the impact of AI adoption on its intellectual property. Which of the following BEST addresses this concern?

In a Zero Trust architecture, which element is MOST important for an IS auditor to evaluate to ensure that resources are accessed securely?

Which of the following are examples of corrective controls?

What type of control has been implemented when secure code reviews are conducted as part of a deployment program?

Which of the following would BEST assist an IS auditor in understanding the inputs and outputs of a microservice-oriented application?

Which of the following would be of MOST concern to an IS auditor reviewing a data loss prevention (DLP) solution implementation for endpoints?

To ensure the organization is able to centrally manage mobile devices to protect against data disclosure, it is MOST important for an IS auditor to determine whether:

Which of the following MOST effectively reduces the risk of emails containing personally identifiable information (PII) being sent to unauthorized recipients?